diff options
| author | Anton <anton@picapica> | 2019-06-04 12:58:21 +0400 |
|---|---|---|
| committer | Anton <anton@picapica> | 2019-06-04 12:58:21 +0400 |
| commit | e4d7941d90684379fa1b32db2c96bdb4be117560 (patch) | |
| tree | c58746e341ebfc47b996c24139b95dea9453cd74 | |
| parent | da5882b9786fd364be48e0a3669bb29f0186e5ca (diff) | |
| download | pica-pica-e4d7941d90684379fa1b32db2c96bdb4be117560.tar.gz pica-pica-e4d7941d90684379fa1b32db2c96bdb4be117560.zip | |
append @SECLEVEL=0 to the anon cipherlist string when building with OpenSSL >= 1.1.0, ADH ciphers are disabled by default in OpenSSL 1.1.0 branch
| -rw-r--r-- | PICA_client.c | 4 | ||||
| -rw-r--r-- | PICA_node.c | 4 |
2 files changed, 8 insertions, 0 deletions
diff --git a/PICA_client.c b/PICA_client.c index d589137..d7674db 100644 --- a/PICA_client.c +++ b/PICA_client.c @@ -1500,7 +1500,11 @@ int PICA_open_acc(const char *cert_file, ret = SSL_CTX_set_cipher_list(a->ctx, PICA_TLS_CIPHERLIST); if (ret == 1) +#if OPENSSL_VERSION_NUMBER < 0x10100000L ret = SSL_CTX_set_cipher_list(a->anon_ctx, PICA_TLS_ANONDHCIPHERLIST); +#else + ret = SSL_CTX_set_cipher_list(a->anon_ctx, PICA_TLS_ANONDHCIPHERLIST "@SECLEVEL=0"); +#endif if (ret != 1) { diff --git a/PICA_node.c b/PICA_node.c index c38fd4a..0e9615d 100644 --- a/PICA_node.c +++ b/PICA_node.c @@ -1762,7 +1762,11 @@ int PICA_node_init() if (ret != 1) PICA_fatal("Failed to set DH parameters"); +#if OPENSSL_VERSION_NUMBER < 0x10100000L ret = SSL_CTX_set_cipher_list(anon_ctx, PICA_TLS_ANONDHCIPHERLIST); +#else + ret = SSL_CTX_set_cipher_list(anon_ctx, PICA_TLS_ANONDHCIPHERLIST "@SECLEVEL=0"); +#endif if (!ret) PICA_fatal("failed to set cipher list " PICA_TLS_ANONDHCIPHERLIST); |